SafeLink Decoder — Unwrap Outlook SafeLinks & Proofpoint URLs
Unwrap Outlook SafeLinks and Proofpoint URL Defense links to the real destination — paste one link or a whole email body. Free, no upload, in your browser.
🔒 Everything is unwrapped locally in your browser — no link is ever uploaded.
Unwrap Outlook SafeLinks and Proofpoint URL Defense links
Corporate mail security rewrites the links in your inbox so they point at a scanner first. Microsoft Defender for Office 365 turns a link into https://*.safelinks.protection.outlook.com/?url=…, and Proofpoint turns it into https://urldefense.com/v3/__…__;…. SafeLink Decoder reverses both so you can read and copy the real destination before clicking — paste a single link or an entire email body and every wrapped URL is expanded at once.
Outlook, Proofpoint v2 and v3 all supported
Outlook SafeLinks keep the target in the url query parameter, which is simply URL-decoded. Proofpoint urldefense v2 stores the target in the u parameter with -/_ character swaps, while v3 replaces special characters with * tokens backed by a Base64 table. This decoder implements all three, peels nested wrappers such as an Outlook link that wraps a Proofpoint one, and leaves any URL that isn’t a known wrapper untouched.
Private by design
Everything runs as client-side JavaScript in your browser. No link, email or header is ever uploaded — which matters because rewritten links usually carry tenant IDs and recipient-specific tracking tokens.
Frequently asked questions
What is an Outlook SafeLink?
It is a link rewritten by Microsoft Defender for Office 365 (formerly ATP) to route through safelinks.protection.outlook.com for scanning. The original address is held in the url parameter, which this tool decodes back to the destination.
How do I decode a Proofpoint urldefense link?
Paste the urldefense.com/v3/… or urldefense.proofpoint.com/v2/… link and the decoder rebuilds the original URL from Proofpoint’s token encoding — no Proofpoint account or API is needed.
Does decoding a link visit or open it?
No. Decoding only rewrites the URL text back to its original form; nothing is fetched or opened, so you can safely inspect a suspicious link before deciding whether to trust it.